Dynamic Alert Threshold Adjustment for Security Event Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security systems face challenges in managing alerts for suspicious activity, as they often generate a high volume of false positives to avoid missing important events, leading to a need for a system that can limit alerts without missing critical events.
Innovation Solution
A method is introduced to manage alerts by setting a budget, adjusting a working threshold based on recorded top risk scores within a sliding interval window, normalizing risk scores, and reporting alerts only when they exceed a reference threshold, allowing for dynamic adjustment of the threshold at predetermined intervals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a low working threshold is used to avoid missing important events, then the system achieves high reliability in detecting security events, but the number of false alerts increases significantly
Solution Approach 1:
The working threshold is made dynamic rather than static. The system automatically adjusts the working threshold based on the observed distribution of risk scores and the alert budget constraint. This allows the threshold to adapt to changing conditions while maintaining the balance between detecting important events and limiting false alerts.
Solution Approach 2:
The system uses feedback from the observed risk score distribution and alert generation patterns to continuously optimize the working threshold. By monitoring which scores trigger alerts and comparing against the budget constraint, the system learns and adjusts the threshold to achieve optimal detection performance within the allowed alert volume.
2Quantity of substance
If a high working threshold is used to limit the number of alerts, then the system achieves manageable alert volume, but important security events may be missed
Solution Approach 1:
The system changes the parameter (working threshold) based on the observed data distribution and constraints. Rather than using a fixed high threshold that might miss events, the threshold is adjusted according to the actual risk score patterns observed in the system, ensuring optimal detection within the alert budget.
3Adaptability or versatility
If multiple risk categories are monitored to comprehensively detect suspicious activity, then the system achieves high adaptability in detecting different types of threats, but the total number of alerts increases due to multiple trigger points
Solution Approach 1:
The system merges the monitoring of multiple risk categories into a unified alert generation process. By normalizing risk scores across different categories and applying a single adjustable working threshold, the system coordinates alerts from multiple sources while respecting the overall budget constraint, reducing the total alert volume while maintaining comprehensive coverage.
Data Source
AI summary
Setting a budget of alerts for single or multiple risk score types, adjusting a working threshold based on the set budget, wherein adjusting the working threshold is done by defining an reference threshold for an alert, providing a history of recorded risk scores within a budget sliding interval window and adjusting the working threshold such that a number of alerts which would have been provided by the recorded risk scores is calculated to stay within the set budget, and using the adjusted working threshold to normalize and optionally combine incoming risk scores so as to determine whether an incoming risk score should receive an alert.